md5 and gpg check failed

[scottWahlstros]

Version

2.4.190

Installation Method

Security Onion ISO image

Description

other (please provide detail below)

Installation Type

other (please provide detail below)

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

64

Storage for /

1tb

Storage for /nsm

1tb

Network Traffic Collection

other (please provide detail below)

Network Traffic Speeds

Less than 1Gbps

Status

No, one or more services are failed (please provide detail below)

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

First off, thank you for continuing to support OSS and you're product is amazing!!! I purchased the "2.4" book and look forward to setting up my POC lab at home as to prove to my leadership at work that your product is a viable option that provides visibiilty that few other products can do.

My post here is a simple issue and I am not under a deadline (in fact I'm off work all weekend for the holiday) - so please, don't work on this if y'all are on holiday as well....

So my issue: While following the directions found in this project's "https://github.com/Security-Onion-Solutions/securityonion/blob/2.4/main/DOWNLOAD_AND_VERIFY_ISO.md" page, I downloaded and installed the GPG .sig file successfully. I then downloaded the .iso and using the cmdline instructions the directions, attempted unsuccessfully to verify the GPG signature. I then ran md5sum on the .iso and found a mismatch between the "DOWNLOAD_AND_VERIFY_ISO.md" page and the .iso .

Steps to recreate:

Download the keys:

labtech@lab0:~$ wget https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/2.4/main/KEYS -O - | gpg --import -

--2025-11-29 10:42:10-- https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/2.4/main/KEYS
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.111.133, 185.199.108.133, 185.199.109.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.111.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3187 (3.1K) [text/plain]
Saving to: ‘STDOUT’

•                                100%[====================================================================>]   3.11K  --.-KB/s    in 0.005s  
  

2025-11-29 10:42:10 (585 KB/s) - written to stdout [3187/3187]

gpg: key 7C1060B7FE507013: public key "Security Onion Solutions, LLC info@securityonionsolutions.com" imported
gpg: Total number processed: 1
gpg: imported: 1

Download the .sig:

wget https://github.com/Security-Onion-Solutions/securityonion/raw/2.4/main/sigs/securityonion-2.4.190-20251024.iso.sig
--2025-11-29 10:46:30-- https://github.com/Security-Onion-Solutions/securityonion/raw/2.4/main/sigs/securityonion-2.4.190-20251024.iso.sig
Resolving github.com (github.com)... 140.82.112.3
Connecting to github.com (github.com)|140.82.112.3|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/2.4/main/sigs/securityonion-2.4.190-20251024.iso.sig [following]
--2025-11-29 10:46:30-- https://raw.githubusercontent.com/Security-Onion-Solutions/securityonion/2.4/main/sigs/securityonion-2.4.190-20251024.iso.sig
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.108.133, 185.199.111.133, 185.199.110.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.108.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 566 [application/octet-stream]
Saving to: ‘securityonion-2.4.190-20251024.iso.sig’

securityonion-2.4.190-20251024.iso.s 100%[====================================================================>] 566 --.-KB/s in 0s

2025-11-29 10:46:31 (68.3 MB/s) - ‘securityonion-2.4.190-20251024.iso.sig’ saved [566/566]

Download the .iso

labtech@lab0:~# wget https://download.securityonion.net/file/securityonion/securityonion-2.4.190-20251024.iso
--2025-11-29 07:52:50-- https://download.securityonion.net/file/securityonion/securityonion-2.4.190-20251024.iso
Resolving download.securityonion.net (download.securityonion.net)... 104.26.14.42, 104.26.15.42, 172.67.69.209, ...
Connecting to download.securityonion.net (download.securityonion.net)|104.26.14.42|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/x-iso9660-image]
Saving to: ‘securityonion-2.4.190-20251024.iso’

securityonion-2.4.190-20251024.iso [ <=> ] 14.50G 12.9MB/s in 13m 0s

2025-11-29 08:05:51 (19.0 MB/s) - ‘securityonion-2.4.190-20251024.iso’ saved [15569256448]

verify the sig against the iso:

labtech@lab0:~# gpg --verify securityonion-2.4.190-20251024.iso.sig securityonion-2.4.190-20251024.iso
gpg: Signature made Thu 23 Oct 2025 06:21:46 AM CDT
gpg: using RSA key C804A93D36BE0C733EA196447C1060B7FE507013
gpg: BAD signature from "Security Onion Solutions, LLC info@securityonionsolutions.com" [unknown]

check the md5sum on the .iso (doesn't match the md5 listed on the "DOWNLOAD_AND_VERIFY_ISO.md" page)

labtech@lab0:~$ md5sum securityonion-2.4.190-20251024.iso
459f6670b49dcdb5251d127edf4fbc45 securityonion-2.4.190-20251024.iso

From the documentation:

Download and Verify

2.4.190-20251024 ISO image:
https://download.securityonion.net/file/securityonion/securityonion-2.4.190-20251024.iso

MD5: 25358481FB876226499C011FC0710358
SHA1: 0B26173C0CE136F2CA40A15046D1DFB78BCA1165
SHA256: 4FD9F62EDA672408828B3C0C446FE5EA9FF3C4EE8488A7AB1101544A3C487872

Thank you all in advance for your time!

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[defensivedepth]

I just ran the same commands (wget url and then md5sum) you ran and got the expected hash:

 md5sum securityonion-2.4.190-20251024.iso                                                                                        
25358481fb876226499c011fc0710358  securityonion-2.4.190-20251024.iso

I would suggest downloading a fresh copy.